The Wall Street Journal broke the story.

The history: UnitedHealth acquired Change in 2022. The business is now part of UnitedHealth's Optum unit, which provides health care and health care support services.

Change helps self-insured employer plans, health insurers, hospitals, clinics and physicians' practices exchange the information used to submit and pay claims.

The ALPHV Blackcat ransomware group breached a Change server in February 2024, used that breach to get into other Change systems, and may have gained access to the protected health information of 190 million people, according to United Health.

The breach and UnitedHealth efforts to contain the breach and restore its systems froze cash flow for thousands of medical practices for weeks and, in some cases, for months.

Andrew Witty, UnitedHealth's CEO, testified at a Senate Finance Committee hearing in May 2024 that the company was trying to ease the financial impact of the crisis by offering the affected health care providers no-interest, no-fee loans.

"We will provide this assistance for as long as it takes to get providers claims and payments flowing up to pre-incident levels," Witty said during the hearing.

A health care counsel's perspective: Rachel Carey, a health care law specialist who has seen the repayment request letters and the emergency support loan documents, wrote in a commentary posted Monday on LinkedIn that the loan agreements may let UnitedHealth use reimbursement payment offsets to collect on the loans. "However, the terms of these agreements appear to have taken advantage of providers who were desperate for financial relief following the hack," Carey wrote.

The current repayment demands could hurt the stability of health care practices that are still recovering from the Charge attack, Carey said.

Change Healthcare's response: Change Healthcare said via email that it intended when it started the loan program to "help bridge the gap in short-term cash flow needs for those providers impacted by the disruption of Change Healthcare's services."

"Now, more than one year post the event and with services restored, we have begun the process of recouping the interest-free funding we provided to providers — as [the U.S. Department of Health and Human Services] itself did when it began recouping payments it provided under its own cyber-attack lending program in July 2024," Change Healthcare said. "We continue to work with providers on repayment and other options, and continue to reach out to those providers that have not been responsive to previous calls or email requests for more information."